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In reply refer to: 


INTERNATIONAL SECURITY AFFAIRS 1-6803/75ct 


Honorable Rogers C.B. Morton 
Secretary of Commerce 
Department of Commerce 
Washington, D.C. 20230 


Dear M z 


(C) in accordance with the agreement reached by the Export Admin- 
istration Review Board at its meeting in your office on October 29, -. 
1974, we are sending you the enclosed report on safeguards for the 
IBM computer installation proposed for the INTOURIST reservation 
system. The report was prepared by an interagency task force con- 
vened by the Department of Defense. Its members were drawn from 
State, Defense, Commerce, AEC and NASA. : : a 


(C) This is by far the most difficult and, in our judgment, the most 
significant of the three large computer cases the Board has been called 
on to consider, and we must tell you that we have serious doubts as to 
whether the U.S. Government should approve it. Our concerns arise 
primarily because this system is more sus ceptible of diversion than 
either the KAMA RIVER or AFROFLOT installations, its use by the 
KGB to enhance their surveillance operations substantially is both © 
likely and unpreventable and, by supplying an undeniable precedent. 
for the release to the Soviet Union of very large, data-base oriented. 
computers, approval by the U.S. will undercut our efforts to main- . 
tain an effective system of computer export controls. 


(U) To facilitate evaluation of the report by the Export Administration 
Review Board, we have taken the liberty of forwarding a copy of this let- | 
ter and its enclosure to the other members of the Board. We have also. 

- sent copies to the principals of the other agencies represented on the 

task force, 


(U) We would be interested in hearing your views. 


Enclosure 
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4 JUL 1975 
In reply refer to: 


INTERNATIONAL SECURITY AFFAIRS ; I-6803 f T5ct 


' MEMORANDUM FOR The Deputy Secretary of Defense 


SUBJECT: INTOURIST Reservation System 


(C) On October 29, 1974, the Export Administration Review Board 
asked the Department of Defense to convene an interagency task force 
to study the feasibility of safeguards to be applied in the interest of 
U.S, national security to certain large computer systems proposed 

for export to the Soviet Union. This is the report of the task force on 
the third and Jast of these cases, the IBM fete ae to cOmpnrotize the — 
INTOURIST reservation system. 


CONCLUSIONS 
i. (C) This is the largest U.S., and in some respects the largest 
Western, computer system so far proposed for installation in the 


Commenist world. 


2. (C) Because of its size and the nature of the tasks it will per- 
form, it a substantial amounts of excess computing power available 


' for diversion to significant military uses. 


3. (C) The Saau configuration of this. installation, its ability to be 
separated into two viable systems, the interchangeability of its cen- 
tral processing units (CPU's), and the very large number of periph- . 
eral memory devices it contains, combine to provide numerous 
means by which substantial proportions of the system's total capacity 
can be surreptitiously diverted to other than its stated purposes, 


4. (C) Beyond the possibility of diversion to military purposes, 
it is highly likely that some of this system will be used to enhance 
KGB surveillance and control activities. 


. 
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(GC) There are no feasible modifications of the CPU's which _ 
will safeguard against their use for other than their stated purposes. 


(C) A substantial reduction in the number of type-3330 disk 
drives can be made without impairing the operation of the system, 
at least in the initial phases, and will provide a measure of protec- 
tion against their diversion. ; 


(C) Restricting the number of Soviet personnel trained and the 
kind and amount of training provided in hardware maintenance, as well 
asin systems and software design and development, to the minimum 
necessary and appropriate to the installation wilk limit undesirable 
technology transfers. 


8, (U) The safeguards outlined in Appendices I and II of this 
repor 7 can be reasonably effective in deterring and detecting signifi- 
cant time diversion of this system to military purposes and in limit- 
ing eedoegiie te chnology transfers. 

5. {C) There are no safeguards which can be installed against 
diversion of the system to KGB or police-type uses in parallel with 
bone fide INTOURIST functions. 


. (U) Computer installations approved on the basis of reliance 
on Rae need to Re held to the minimum possible in both number 
and size, 


RECOMMENDATIONS 


{U) The task force makes no recommendation on whether this case 
should be approved or disapproved on the ground that this is a policy 
matter outside its competence. 


(C) What it does say is that if, after considering the risks involved, a 
decision is made to approve this transaction, the following measures 
to reduce as far as possible the diversion of this system are recom- 
mended: _ 


ANIMATE A 
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1, The system will be limited to one 370/145 and one 370/158 
central processor, 24 type 3330 disk drives and appropriate periph- 
eral equipment, without prejudice to the replacement of the 370/145 
with a second 370/158 and the addition of more disk drives when a 
need for them can be demonstrated, 


2. The requirements outlined in Appendices Tand II of this 
report be included as conditions of any license for this installation. 


' The INTOURIST Organization 


(C) INTOURIST is the Soviet Union's state operated travel agency 
which controls all hotel, restaurant, theater, shop, train and air 
bookings for non-Soviet citizens inside the USSR and for Soviet 
citizens outside of the USSR. It also provides some services for 
Soviet citizens inside the USSR: In 1974 INTOURIST supplied 
Services to 3, 447, 000 foreigners and 1, 650, 000 Soviet citizens 
traveling inside the USSR and to 2,225,000 Soviet citizens traveling 
i2 the USSR, 


outsisie 


'(C) Given the nature of the Soviet state, with its emphasis on close 


control of its own citizens, wherever they are, as wellas iorcigners 
Within its borders, even the most routine aspects of travel require 
oificiel approval. The result is an extraordinary degree of inflexi- 
bility in travel arrangements. Once a particular hotel reservation 
has been made or an itinerary approved, it is very difficult to change, . 
To alter travel plans on short notice is well nigh impossible. Since 
contingencies requiring changes are constantly arising, the Soviet. 
traveller, foreigner and citizen alike, regularly experiences con-- 
fusion, inefficiencies, uncertainties and delays. The Soviet Govern- 
ment recognizes that much of the friction could be reduced, without 
Sacrificing ~~ indeed with a possible improvement in ~~ official 
control of the movement of people, if they had information on the 
traveller, his itinerary, and requirements for various services on 
an up-to-the-minute basis and could match that information against 
an equally up-to-the-minute inventory of available accommodations. 
It is primarily this function which the IBM computer system is intended 
to serve. 


. 
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(C) The Soviets have specified that the system is to be designed to 
process a 1978 peak of 11 million travellers -~ both foreign and 


‘Soviet -- to deal with 1000 foreign and commercial travel agencies, 


and to keep track of and assign tourists to 500 hotels in 250 cities, 
500 trains, 35 ships, rent-a-cars in 200 cities, INTOURIST cars in 
250 cities, 280 theaters in 200 cities and 300 restaurants in 250 
cities, : 


Description of Equipment 


(C) The computer system which IBM proposes to supply is based upon. 
the airline reservation system that IBM has marketed rather success~ 
fully for a number of years. However, itis larger than most such 
systems and contains a larger variety of functions in keeping with the 
greater variety of tasks which the INTOURIST agency performs, 


(C) The proposal calls for the linking together of two IBM 370 central 
processing units (CPU's), one to process on-line interactive requests 
for information and for the updating of information files, and the other 
to peziorm ancillary jobs on a batch basis while it simultaneously 


serves 2s back up for the on-line real-time computer system. Con-~ 
nectec to these CPU's would be appropriate peripherals including 48 
type-3330 disk drives, . 


(C) Delivery would be made in phases, Initially, as soon as the 
license is granted, an IBM 370/145 computer with a small number of 
appropriate peripherals, including 8 type 3330 disk drives, is ta be 
delivered for instructional and program development purposes. After 
about a year, an IBM 370/158 computer with the remainder of the 
peripherals, including 40 additional] 3330 drives, would be delivered, 
At this point, the proposal calls for the commencing of actual 
INTOURIST operations with the 370/158 computer serving as the real-_ 
time, or on-line, computer upon which the reservations are normally 
transacted. -The 370/145 computer would be utilized as the off-line 
computer to produce the large number of ancillary reports and sum- 
maries including statistical and genera] management information 
required to make the system function effectively. It would simulta- 
neously serve as the back up for the on-line function should the 
370/158 fail. 
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(C) When the work load on the real-time machine becomes sufficiently 
high that the 370/145 could not properly serve as the back up, or when 


_ the batch load for the 370/145 becomes too large for it to handle, IBM 


proposes to replace the 370/145 with a second 370/158. At that time the 
dual system would be transformed into two 370/158's, and the 370/145 
then being surplus presumably would be moved out of the system. 


(C) The peripherals specified include the 48 type~3330 disk drives 
already mentioned of which approximately 30 are for the primary data’ 
which is to be available on line, 10 for off-line inventories, 5 for 
systems residency and libraries and the remainder as spares. In 


_ addition, 8 type 3420-5 high-speed tape drives, each with an effective 


bit transfer rate of 1.6 Mb/sec, are to be supplied, along with two 
dual-access controllers. A pair of front-end communication pro- 
cessors, Model 3705-Al, are included for the interconnection of a: 
large number of terminals through the system. The proposed termi- 
nals, numbering 187 in total, include 140 Model 4505 alpha-numeric 
display terminals for use by booking agents. In addition, a number 
of perizheral units for the handling of cards and printed output are 
associated with the system. 


CG) The software to support the reservation system.is designated 
IPARS. Additional batch processing procedures above and beyond 
those already included in IPARS are performed under the standard 
IBM batch operating system designated OS/VSI. ws 


Diversion Potential | 


(C) The risk that a computer system may be diverted to an unauthorized 
use is present to the extent that the system has a significant amount of 
excess capacity available and contains the means, either through hard- 
ware or software, for tapping that capacity surreptitiously. With this 

in mind, the proposed IBM system as a whole as well as each of its. 
major elements has been examined, | ‘ 
(C) The first fact that needs to be noted is that this is a very large 
system which far exceeds the limits set by COCOM for approval on 
other than exceptional grounds, For example, the processing data 
rate (PDR) of the 370/145 is 14.8 and the PDR of each of the two 
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370/158's is 43. (The COCOM normal limit is set at a PDR of 32. ) 
Thus, except for the initial learning phase when only the 370/145 is 
in place, the total installed computing power is quite large. For this 
reason, the diversion of a relatively small portion of this system to 
unauthorized purposes would be of much greater significance then | 
would be the case were it smaller. Fi 
(C) While the significance of any diversion tends to be a function of 
size, itis the configuration and design of the system which tends to 
govern the extent to which the potential for diversion is present. In 
the INTOURIST system, the potential varies eereeane on WESEneE on= 
line or off-line operations are being considered. 


On-Line Cperiess 


(C) The nature of the traffic which must be handled on-line is such that 
in order to accommodate appropriate high volume activity during the 
course of a normal working day with reasonable responsiveness,. thé 
amount of computing power provided by a 370/158 tends to far exceed 
the acmal average needs. _eOy somewhat different reasons, which will 


storage Veapaciiy in the 30 type-3330 disc Seve: re to on-line 
operations. These features, when coupled with the fact the IPARS 


‘System under which the on-line operations are carried out can be 


easily modified or augmented to utilize this excess capacity for 
additional tasks, gives rise to a system in which there is a possibility 
of substantial diversion.: 


Off-Line Operations 


(C) In total computing power and in its dual CPU configuration (which 
is a requirement for any installation which must be operable at all 
times) this system is similar to that recently approved for AEROFLOT. 
However, a Significant difference is that the INTOURIST system can be 
separated into two viable computers, each able to perform substantial 
computing functions, Thus, in this case, it is imagineable that during 
the course of a day, the standby off-line computer could be put to a 
clandestine use with very little chance of detection, if one considers 
only external observation. Moreover, since both central processors 
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are interchangeable the 370/145 could be switched to the on-line reser- 
vation function, and the 370/158 utilized on off-line batch work at least 
50% of the time. In addition, a minimum of 16 type-3330 disc drives 
are available to the off-line CPU, which means that the 370/158 when 
diverted to off-line operations would be able to perform very sub- 
stantial scientific or information retrieval tasks. 


Use by KGB 


(C) Ordinarily the question of diversion arises in connection with the 
use of a computer for military purposes. The INTOURIST proposal 
embodies an additional basis for concern, namely, the extent to which 
this system will enable Soviet authorities, including the KGB, to more 
fully automate their ccntrol over foreign visitors throughout the Soviet 
Union as well as over their own citizens traveling both at home and 
abroad. Although INTOURIST is not a KGB controlled instrumentality, 
there are close links and well-established working relationships between 
the two organizations. Several Deputy Directors and a number of 
INTOURIST representatives abroad have been identified as KGB officers 
or agents over the years, | 


{(G) The KGB is responsible for combating intelligence activity by 
tourists and for the recruitment of tourists as agents. It also runs 

an extensive network of agents and informants among INTOURIST 
interpreter-guides and other employees of this organization. Not all 
INTOURIST interpreter-guides are recruited KGB agents or informants, 
but all must submit daily reports on the tourists.under their care ag 
part of their job. These reports are passed to KGB officers who relay 
them to appropriate KGB elements which decide what operational 
activity will be undertaken. When necessary, instructions are passed 
back to the interpreter- guides through these officers. 


(GC) Requests for tourist visas for foreigners, whether submitted 

_ through local travel agencies or INTOURIST offices abroad, are all 
forwarded to INTOURIST Headquarters in Moscow, which, in turn, 
forwards them to KGB where they are reviewet for operational leads, 
Since 1961, the KGB has received a daily machine listing of all tourists 
who entered the USSR the previous day. These listings, as of 1964, 
contained the name, date and place of birth, and planned len gth of stay 
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for each tourist. There was also a much shorter list identifying . 
Americans who had made previous trips to the USSR, setting forth 
the number of trips made, dates, and the names of KGB officers 
who had worked on these cases, 


(C) It can be assumed that this proposed INTOURIST computer system 
when working at its designed performance level will enhance KGB sur- 
veillance capabilities, Its huge memory, instant recall, and ease of' 
access through its remote terminals will provide an instrument of 
unparalled usefulness for their purposes. 


Safeguards Against Diversion 


{C) After identifying the several ways this system could be diverted, 
the task force attempted to devise means to eliminate or reduce to 

_ acceptable levels the risk of use of this equipment for other than its 
stated purpose. We began by considering the central processing | 
units. ; 


The Céntral Processor (CPU's) 


({C) One of the attributes of a CPU which enables it to do advanced 
scientific and mathematical computations, such as are required in 
weapons design calculations, is floating point capability. . The task 
force, therefore, examined the possibility of completely disabling 

or degrading this capability in the INTOURIST CPU's, as well as a 
number of other ways of limiting their mathematical computation 
capabilities, In each case, however, the engineering changes which 
would be required turned out to be either prohibitively costly to the _ 
vendor or easily reversible by the Soviets. (Details are given in . 
the Appendix to this report. ) 


(C) The task force concluded that there are no safeguards to be found 
in feasible modifications of the CPU hardware. 


Disk Drives 


(C).To meet the requirements specified by the Soviet customer, the 
IBM proposal has allocated a very large amount of disk space for the 
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data base files. Asa consequence, the total of 48 type 3330 disk drives 
they propose to furnish is a very large number -- much larger than any 
system heretofore supplied to the Soviet Union by a Western manufacturer. 


(C) The concern with the type 3330 disk drive begins with the fact that it 
is a high-performance device embodying advanced technology and ideally 
suited to large data base oriented systems with military applications. 

It is also two generations better than anything the Soviets are known to. 
be producing. Moreover, since itis easily transported, physical 
diversion to another computer system is relatively simple. One safe- 
guard against such a possibility is frequent inventory of the drives at the 
computer site. A more effective one is to insure from the outset that 

no drives are being supplied in excess of the Peeronaicee needs of the 
computer eyetem, | 


(C) Given the large amount of data which the Soviets have specified is 
to be manipulated, the file space is not inordinately large if the clas~ 
sical IDM mechanisms for solving such problems are taken into account. 
Although the overall storage algorithms and procedures could be more 


_ efficient, IBM has organized a procedure which appears to work for 


most of its current customers even though it is not the most efficient 
system imaginable. Assuming the need for maintaining all these files, 
the task force finds that a PERT CICA for 48 type 3330 disk might be. 
established. 


(C) Nevertheless, froma program standpoint, not all these files appear 
to be necessary. Duplication of some for speed of retrieval. clearly 
could be dispensed with, at least initially. Other files can be con- 
tracted and possibly eliminated. By so doing it appears possible to 
reduce the number of required disk drives by something like 30% with- 
out in any substantive way affecting the performance of the system, 

at least in the initial stages. It may even be possible initially to 

reduce the number by as much as 50% but it is unlikely that reduc- 

tions could be made much beyond that point without redesigning the 
whole IPARS system, 


(c) The task force considered the question oe substituting a lower 
performance disk, such as the 2314, for the 3330 but judged that it 
would not be a viable alternative. The 2314 disks are not a current 
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IBM production item and although it is probably possible to find such 
‘disks, it certainly would not be normal IBM business procedure to 
find and supply them. In addition, there are some technical problems 
which would have to be dealt with if 2314 disks were used. Further- 
more, even if the substitution were made, the total amount of storage 
supplied will not change materially and if this system is going to be 
allowed at all, it appears appropriate to allow it to go with 3330's. 


Other Equipment 


(C) Although most of the other peripherals associated with this 

acquisition are quite modern by themselves, none of them gives rise 

to worrisome diversion questions provided some standard safeguards 

are employed. The only remaining question would be the fate of the 
370/145 when and if the second 370/158 is delivered. Of course, the 

- 370/145 with a PDR of 14.8 is not an enormous addition to the Soviet 

computing capability, but it would be appropriate to make sure that 

it not be transferred to some unknown or unapproved end-use or 

. end-user, ‘ 


Software 


{C) In the software area IBM will be transferring their most recent 
general purpose batch operating system OS/VSI and also their highly 
specialized and effective, but not highly sophisticated, IPARS 
reservation system. The on-line reservation computer will normally 
have the IPARS system resident in it. With that system there is no 
way in which an agent's console could be used to enter batch jobs into 
this computer or for that matter izito the off-line computer. In that 
sense, the on-line computer is safe. However, as pointed out earlier, 
the IPARS system itself can be modified to enable the on-line computer 
to do additional significant information processing tasks. The off-line 
computer on ‘the other hand will normally be operating under OS/VSI, a 
general purpose batch processing system. As configured presently, 
remote batch processing is not possible. Nevertheless, the computers 
can be used for batch jobs by terminals located within the computing 
room. The batch processing could, of course, be bona fide INTOURIST 
activities. On the other hand, a mix of other jobs could certainly flaw 
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through the system if the Soviets are so inclined. However, itis 
possible to place Systems management accounting programs to monitor 
the activity in the off-line, and to a lesser degree in the on-line systems, 
The Soviets appear to be amenable to this and with such systems 
management accounting programs, along with the kind of safeguards 
reporting devised for the AEROFLOT System, if should be possible to 
monitor the operation in such a way that any substantial diversion of 
off-line computing time would stand some chance of being detected. 

A more secure system of safeguards is possible. It would, however,’ 
be more elaborate and, among other things, would involve continuing 
U.S. Government costs for processing data obtained for monitoring 

_ purposes from the daily operations of this installation. However, 
diversion of the on-line system to other purposes such as those of the 
KGB probably could not be detected by any system of procedures, 


Techrology Transfer © , ; 


(C) in the technology transfer area the whole System is a very large one 
and represents current state of the art computing technology in the 
United States, Although in one form or another the Soviets have seen 

* and 21so have all of the technology represented here and although it 
represents the same level as the KAMA and AEROFLOT cases 

previously approved, this will give rise to one of the largest concen- 
trations of such equipment in one location. It is, therefore, inevitable 
that some amount of technology will be transferred simply by the delivery 
of this system. 


(C) While the furnishing of the IPARS system to the Soviets does represent 
a transfer of modern technology, the ideas are not new. The implemen~ 
tation is useful but not so Significant as to make its transfer a matter — 

of major concern. The off-line monitor OS is a more sophisticated 
general operating system, but the Soviets have earlier versions of this 
operation system and, in that sense, this will not be new material for 
them, Nevertheless, the transfer of information might be minimized 

here by suppressing the source code, , , 


(C) The primary transfer of technology will be in the education and 
training of the Soviet technicians and engineers who operate and 
maintain the system, Although there are already competent computer 
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technicians in the Soviet Union, this acquisition like any other single 
large sophisticated installation will give rise to yet another group of 
highly trained individuals in areas of sophisticated computer tech- 
nology. Under these circumstances, controlling the transfer of this 
kind of technology translates into a need to limit the number of people 
trained by the contractor and the amount and kind of contractor provided 
training to the minimum necessary to make the installation viable. 


Reliance on Safeguards 
SET es ON wale guards 


(C) In the past few years the idea has gained acceptance that the export 
of militarily significant computers to Communist countries can be 

. approved as long as appropriate "safeguards" against diversion are 
imposed. Depending on the size and nature of the installation, these 
safeguards may include residence of the vendor's engineers on the 

site for a specific period of time, accounting for and reporting on the 
use anc operation of the computer system, and a number of other’ 
procedures designed to detect and thus deter physical removal or 
diversion of the equipment from its stated purposes. However, what 
tends to be overlooked is the fact that safeguards provide no guarantee 
agains: version; they only reduce its likelihood to what ina given 
instance is regarded as an acceptable Jevel. This means that the 

more installations there are in which reliance is Placed upon safeguards 
the greater the probability that significant diversions will take place 
undetected. 


a 
as 
ai 


(C) The task force points this out simply as a reminder that, quite 
apart from the acceptability of safeguards in a given case such as the 
INTOURIST proposal, it is a matter of some importance to hold 
installations requiring the application of safeguards to the minimum 


number and size possible. . 
Gbititiver, lf LC eet Mone 


Enclosures Maurice J/ Mountain 
Chairmah, Interagency Task 
Force on Computer Safeguards 
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APPENDIX 
Modification of INTOURIST Central Processor Units (CPU's) 


(C) One of the attributes of a CPU which enables it to do advanced 
scientific and mathematical computations, such as are required in 
weapons design calculations, is floating point capability. The task 
force, therefore, examined the possibility of completely disabling 

this capability in the INTOURIST CPU's. Such a procedure could 
almost completely eliminate the use of this system for any significant - 
scientific or mathematically oriented computations. At the same time, 
it would not at all hamper the on-line functions of the reservation 
system, which have no use for floating point operations. However, it 
would remove the ability to do some marginally useful but nevertheless 


‘legitimate off-line batch operations. The cost of making this modifi- 


cation has been estimated by IBM as about $50,000. While this is not 

a prohibitive amount, and may in any event be somewhat high, one 
difficulty with this solution is that it would make the central processing 
units 2c this installation into one-of-a-kind machines. a6 


_(C) The significance of this is that it is normal practice in the computer - 


induscry for the manufacturer to supply free of charge to each customer 
any upcates or modifications subsequently developed for his machine 
throughout its life. Since one of the characteristics of the IBM 370 
series is floating point capability, the software designers and engineers 
spread through the IBM organization take this feature for granted when. 


. they develop modifications. Moreover, such modifications are distri- 


buted automatically to all 370 series owners. With their floating point 
capability removed, either the INTOURIST machines could not benefit 
from such changes (which would mean that the Soviets would have to 
accept computers whose operational efficiency would be essentially _ 
frozen as of the date of their delivery), or IBM would have to set up - 

@ special group to rework for the INTOURIST installation modifications 
which all other 370 series machines would accept. Since IBM would 
regard such a special arrangement on updates for one installation as too. 
costly, the question turns on whether the Soviets would accept a system 
on which the vendor's customary update support would not be provided. 


(C) Amore telling reason against following this course is that the 
floating point operations are actually implemented with a micro~ 
progrem control store. This micro-program control store is’ 


Paha ete iets | 
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loaded from a small master disc furnished with every CPU in this 
series {and thus easily obtainable by the Soviets from some other 
installation if they had to) and selected by a simple hard-wire con- 
nection at the time the system is installed. Put another way, the 
system comes with all its options present. Only those options the © 
customer chooses are activated by the installation engineer, but 
all of them remain present in the system and can be activated by 
reloading the micro-program store which is made possible by a 
slight change in the wiring. What this means is that even if the 
floating point operations were disabled, it would be a fairly simple 
thing for the Soviets to restore them. | 


» 


(C) Another alternative considered by the task force was the possi- 
bility of degrading without totally removing the floating point capability. 
Here the thought was that by reducing the processing data rate (PDR) 
of the 370/158 to at least the level of the 370/145 the updating difficulty 
woulc be overcome and even though the scientific usefulness of the 
CPU was not removed, it would be reduced to a tolerable level: . The 
snag encountered here was the judgment on the part of IBM that while 
it would be possible to do this by removing the accelerator board and 
one h2ii ci the registers the cost of reworking the software to enable 
the machine to function without them was estimated by IBM to be about 
‘$3,005, 000, . . 


(C) A number of other possibilities of limiting the mathematical 
computetion capabilities of the CPU's were considered and explored 
with IBM experts, including changing the micro-program store to a 
"read-only" type, but in each case the engineering changes which. 
would be required turned out to be prohibitively costly. With regard 
to the information retrieval operations for which the on-line system 
is designed, no way was found to reduce the excess capacity through 
changes to the CPU's. The task force concluded that there are no 
safeguards to be found in feasible modifications of the CPU hardware. 
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ANNEX I 


Gom uter § eystem Safeeuards for the Intourist rist Reservation System 
Yomp bystem wateguards for the Intou: rise weServatio Y m 


A ~:'A responsible representative of Intourist will furnish to IBM 
@ Signed statement describing the end use and certifying that: 


(1) The Sama pime nt will acd be used for civil i 


(2) The equipment will not be re-exported or niveneees disposed 
of without permission of the U.S. Government; 


{3) IBM will be notified of any Significant change in application 
or other facts on which the license was based; 


(4) Responsible Western representatives of IBM will have the 
right of free access at all times to the con mputer facility and 
all associated equipment wherever located; 


(5) ISM representatives will be resident at Intourist fora period 
of at least three years after installation and acceptance of 
the IBM 370/158 and until the computer system is dedicated 
at least 75% of the time to the functions of Intourisé, 


(6) IBM representatives will be furnished information a as required 
demonstrating continued Intourist application of the equipment 
including access to all programming documentation pertaining 


‘to programs being run on the computer an rd i information on the 
Ser anee of the computer system; 


(7) The computer system will be run under IBM's supplied operating 
system which will provide standard accounting information and 
will mot be modified nor a different oper ating system used without 
IBM ButnoreetGn: 


(S) IBM representatives will be permitted to monitor end control 
the utilization of spares and return to IBM all replaced major 
assemblies; , 


(9) The information required by Section B, below, will be reported 
sROMEALY to the U.S. Government; 
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IBM representatives will be permitted to report to the U.S. 
Government the other information required below. 


B - Until such time as the computer system is dedicated at least 75% 
to the integrated operational functions of INTOURIST, a representative 
of INTOURIST will prepare and submit monthly to the U.S, Embassy in 
Moscow a report, countersigned by a responsible IBM representative, 
_covering for each CPU separately where appropriate the computer 
. time utilization, including: . 


Total clock time for the period of the report; 


Total computer on time; 


The total computer on time that IBM personnel were at the 


. computer facility; 


Computer on time devoted to hardware and software main- 
tenance with IBM personnel involvement; 


Other time devoted to maintenance: 


Computer on time devoted to software development or system 
integration used by IBM personnel or with IBM personnel 
involvement; 


Other time devoted to development or integration; ’ 


Computer on time devoted to scheduled INTOURIST use with 
IBM personnel involvement; 


Other time devoted to scheduled INTOURIST use; 


Idle computer on time; 
Computer off time devoted to hardware maintenance under 
IBM supervision; 


Other off time devoted to hardware maintenance; 


Other off time. 
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CG ~- IBM will insure that equipment deliveries will be made incre - 
mentally consistent with system implementation needs, A 
responsible IBM representative on site will certify by signing 
the report called for in B, above, that he was present at the 

_ time of its generation, that it is based on computer-cgenerated © 
accounting information, was processed by the IBM provided 
program and generated as a result of that process, 


D- If the monthly report called for in B, above, indicates that for’ 
either CPU more than 25% of the total computer on time IBM 
personnel were not at the computer facility, IBM will report 
whether the computer was either idle or was used for approved 
purposes. In the event that more than 25% of the total computer 

_on time is, in the judgment of the U.S. Government inadequately 
accounted for, a representative of Intourist will provide IBM with 
information as agreed in A (6) above along with approval for its — 
transmittal to the U.S. Government, In adaition, the U.S. Govern-= 
ment may request IBM to monitor the operation of the computers 
more closely, and/or exercise its right of access more frequently 

at times its personnel are not normally at the computer facility and © 
répert its findings. 

E - IBM representatives will be resident at the Intourist installation 

or 2 period of at least three years after installation and acceptance 

of the IBM 370/158 and until the computer system is dedicated at 

least 75% of the time to the functions of Intourist, During this 
period, IBM's Western representative will prepare and submit 


monthly to the U.S. Government a report covering: 


beh 


{1) The status of training of Soviet personnel; 

(2) The status of development of the major application programs 
for the computer systems; 

(3) The total clock time that IBM personnel were at the 
site; 3 


(4) Any change in disposition of the exported computer equip- 
ment or accountability of spare parts; ; 
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(5) Any significant change in facts on which approval of this 
_ case was based and whether in their judgment the computers 
continue to be used for approved purposes at the authorized 
location, : 


After the time that IBM has demonstrated that the ‘computer system 
is dedicated at least 75% of the time to the functions of Intourist, 
IBM's Western representative will make monthly visits and submit 
monthly to the U.S. Government a report covering items E (1), 

(3), (4) and (5) above and whether the computer system continues | 
to be dedicated at least 75% of the time to the approved. use, 

IBM will limit the quantity of spares on-site, after the one-year 
Warranty period, to that necessary for supporting the computer 

for a maximum of four months. — 


equipment or spares from the West or from depots or similar 
computer facilities in the Soviet Bloc, training, maintenance, 
soitware, etc.) of the facility. 
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ANNEX II 


Measures to Limit Technology Transfers for the Intourist Reservation System 


IBM will limit the transfer of technology to the minimum level for the 

installation, operation and maintenance of the computer system. 

‘4. - Maintenance engineers will be limited to the training and information 
necessary to maintain the équipment provided. 


B- Analysts and application programmers will be limited in number) 
and to the training and information necessary to develop the application 
programs not the responsibility of IBM. 


© + The total number of system programmers will be lirnited to six and 
their training and information will be limited to that necessary to 
maintain the operating systems and Support software to be provided: 
The training of the system programmers will be delayed until the 
appropriate time prior to the computer systern being 75% dedicated 
to the integrated functions of Intourist. 4 3 


TD) ~ IBM will limit the provision of the operating systeri and their standard 


library programs to those necessary and appropriate to the Intourist 
applications, oo 
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